Wallets And Key Storage

Seashail is designed so the agent process never receives key material.

Wallet Types

Generated wallets are created inside Seashail and protected using Shamir Secret Sharing (2-of-3):

Share 1: encrypted with a machine secret stored in config_dir
Share 2: encrypted with a machine key by default (seamless onboarding), or re-encrypted under a passphrase for portability (opt-in)
Share 3: shown once as an offline backup during explicit recovery/export operations and not stored by Seashail

Normal operation reconstructs from shares 1 + 2, signs, then zeroes key material from memory.

Imported keys/mnemonics are encrypted at rest using AES-256-GCM with a key derived from your passphrase (Argon2id + HKDF subkeys).

To make automation practical, Seashail caches a passphrase-derived key in memory for a configurable window (passphrase_session_seconds).

Headless/unattended environments can opt in to providing the passphrase via environment variable:

This is lower security by design (plaintext outside Seashail’s control). Use only if you understand the tradeoff.

Create a generated wallet (Shamir 2-of-3):

Import an existing wallet:

Notes:

Never pass secret as a tool argument. Seashail rejects it by design because tool args often end up in agent logs.
Imported private keys require private_key_chain (evm or solana).

Common workflow:

list_wallets to see what exists
set_active_wallet to choose the default wallet/account for subsequent tool calls
add_account to add another BIP-44 account index (generated wallets and mnemonic wallets)
get_wallet_info to inspect addresses for a wallet

Use:

This returns the deposit address for a given wallet / account_index on a chosen chain.

Examples:

{ "chain": "solana", "token": "usdc" }

{ "chain": "base", "token": "native" }

Generated wallets can opt into portability/recovery and receive a show-once offline backup share:

export_shares (rotates shares and displays a show-once Share 3; requires passphrase session)
rotate_shares (rotates shares and displays a show-once Share 3; requires passphrase session)